支持对安全相关事件进行查询和审计,当前可审计事件包括SshLogin(Ssh登录到安全沙箱的事件)、ContainerLogin(本地登录到安全沙箱的事件)、AbnormalConnection(安全沙箱对外的异常网络连接)
下表仅列出该接口特有的请求参数和部分公共参数。更多信息请见公共参数。
参数 | 类型 | 是否必填 | 示例值 | 描述 |
---|---|---|---|---|
Action | String | 是 | ListAuditLogs | 要执行的操作,取值:ListAuditLogs。 |
Version | String | 是 | 2024-01-01 | API的版本,取值:2024-01-01。 |
ResourceId | String | 是 | ep-**************-***** | 资源 ID,取值:
|
ResourceType | String | 是 | endpoint | 资源类型,取值:
|
Filter | Object | 否 | - | 待查询审计日志的筛选条件 |
PageNumber | Integer | 否 | 1 | 分页查询时的起始页码,从 1 开始,默认为 1 |
PageSize | Integer | 否 | 10 | 分页查询时每页显示的记录数,取值:
|
SortBy | String | 否 | Timestamp | 指定排序指标。 可指定值:
默认值: Timestamp |
SortOrder | String | 否 | Desc | 指定排序顺序。 可指定值:
默认值:Desc |
下表仅列出本接口特有的返回参数。更多信息请参见返回结构。
参数 | 类型 | 示例值 | 描述 |
---|---|---|---|
TotalCount | Integer | 1 | 总审计日志数 |
PageNumber | Integer | 1 | 分页查询时的起始页码,从 1 开始,默认为 1 |
PageSize | Integer | 10 | 分页查询时每页显示的记录数,取值:
|
Items | Array of Object | - | 审计日志 |
用于审计 SshLogin 行为
POST /?Action=ListAuditLogs&Version=2024-01-01 HTTP/1.1 Host: https://open.volcengineapi.com Content-Type: application/json; charset=UTF-8 X-Date: 20240627T021205Z X-Content-Sha256: 287e874e******d653b44d21e Authorization: HMAC-SHA256 Credential=Adfks******wekfwe/20240627/cn-beijing/ark/request, SignedHeaders=host;x-content-sha256;x-date, Signature=47a7d934ff7b37c03938******cd7b8278a40a1057690c401e92246a0e41085f { "ResourceId": "ep-**************-*****", "ResourceType": "endpoint", "Filter": { "LogTypes": [ "SshLogin" ] }, "PageNumber": 1, "PageSize": 10, "SortBy": "Timestamp", "SortOrder": "Desc" }
{ "ResponseMetadata": { "RequestId": "20240627101238231161005082456C1E", "Action": "ListAuditLogs", "Version": "2024-01-01", "Service": "ark", "Region": "cn-beijing" }, "Result": { "TotalCount": 1, "PageNumber": 1, "PageSize": 10, "Items": [ { "ResourceId": "ep-**************-*****", "ResourceType": "endpoint", "LogType": "SshLogin", "LogDetail": "172.17.0.1 50030 172.17.0.4 22", "Timestamp": "2024-05-16T12:00:00Z" } ] } }
用于审计 ContainerLogin 行为
POST /?Action=ListAuditLogs&Version=2024-01-01 HTTP/1.1 Host: https://open.volcengineapi.com Content-Type: application/json; charset=UTF-8 X-Date: 20240705T123158Z X-Content-Sha256: 287e874e******d653b44d21e Authorization: HMAC-SHA256 Credential=Adfks******wekfwe/20240705/cn-beijing/ark/request, SignedHeaders=host;x-content-sha256;x-date, Signature=47a7d934ff7b37c03938******cd7b8278a40a1057690c401e92246a0e41085f { "ResourceId": "ep-**************-*****", "ResourceType": "endpoint", "Filter": { "LogTypes": [ "ContainerLogin" ] }, "PageNumber": 1, "PageSize": 10, "SortBy": "Timestamp", "SortOrder": "Desc" }
{ "ResponseMetadata": { "RequestId": "2024070520320624805701201829AFC4", "Version": "2024-01-01", "Service": "ark", "Region": "cn-beijing" }, "Result": { "TotalCount": 1, "PageNumber": 1, "PageSize": 10, "Items": [ { "ResourceId": "ep-**************-*****", "ResourceType": "endpoint", "LogType": "ContainerLogin", "LogDetail": "docker exec -it 29ef24294c46 /bin/sh", "Timestamp": "2024-05-16T12:00:00Z" } ] } }
用于审计 AbnormalConnection 行为
POST /?Action=ListAuditLogs&Version=2024-01-01 HTTP/1.1 Host: https://open.volcengineapi.com Content-Type: application/json; charset=UTF-8 X-Date: 20240705T123428Z X-Content-Sha256: 287e874e******d653b44d21e Authorization: HMAC-SHA256 Credential=Adfks******wekfwe/20240705/cn-beijing/ark/request, SignedHeaders=host;x-content-sha256;x-date, Signature=47a7d934ff7b37c03938******cd7b8278a40a1057690c401e92246a0e41085f { "ResourceId": "ep-**************-*****", "ResourceType": "endpoint", "Filter": { "LogTypes": [ "AbnormalConnection" ] }, "PageNumber": 1, "PageSize": 10, "SortBy": "Timestamp", "SortOrder": "Desc" }
{ "ResponseMetadata": { "RequestId": "202407052034340071951971433E0B1D", "Version": "2024-01-01", "Service": "ark", "Region": "cn-beijing" }, "Result": { "TotalCount": 1, "PageNumber": 1, "PageSize": 10, "Items": [ { "ResourceId": "ep-**************-*****", "ResourceType": "endpoint", "LogType": "AbnormalConnection", "LogDetail": "172.17.0.1 50030 172.17.0.4 22", "Timestamp": "2024-05-16T12:00:00Z" } ] } }
下表为您列举了该接口与业务逻辑相关的错误码。公共错误码请参见公共错误码文档。
状态码 | 错误码 | 说明 |
---|---|---|
400 | MissingParameter.{{Parameter}} | 缺少必要的请求参数。请确认请求参数后重试。 |
400 | InvalidParameter.{{Parameter}} | 请求参数值不合法。请检查参数值的正确性后重试。 |